netdev - Re: [PATCH v2 bpf-next 0/4] introduce bpf_iter for task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 16 Dec 2020 17:35:58 +0000
From:   Song Liu <songliubraving@...com>
To:     Yonghong Song <yhs@...com>
CC:     bpf <bpf@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "ast@...nel.org" <ast@...nel.org>,
        "daniel@...earbox.net" <daniel@...earbox.net>,
        "andrii@...nel.org" <andrii@...nel.org>,
        "john.fastabend@...il.com" <john.fastabend@...il.com>,
        "kpsingh@...omium.org" <kpsingh@...omium.org>,
        Kernel Team <Kernel-team@...com>
Subject: Re: [PATCH v2 bpf-next 0/4] introduce bpf_iter for task_vma

> On Dec 16, 2020, at 9:00 AM, Yonghong Song <yhs@...com> wrote:
> 
> 
> 
> On 12/15/20 3:36 PM, Song Liu wrote:
>> This set introduces bpf_iter for task_vma, which can be used to generate
>> information similar to /proc/pid/maps or /proc/pid/smaps. Patch 4/4 adds
> 
> I did not see an example for /proc/pid/smaps. It would be good if you can cover smaps as well since it is used by a lot of people.

smaps is tricky, as it contains a lot of information, and some of these information
require architecture and configuration specific logic, e.g., page table structure. 
To really mimic smaps, we will probably need a helper for smap_gather_stats().
However, I don't think that's really necessary. I think task_vma iterator is most
useful in gathering information that are not presented in smaps. For example, if a
vma covers mixed 2MB pages and 4kB pages, smaps won't show which address ranges are
backed by 2MB pages. 

I have a test BPF program that parses 4-level x86 page table for huge pages. Since
we need bounded-loop to parse the page table, the program won't work well for too
big vma. We can probably add this program to samples/bpf/, but I think it is not
a good fit for selftests. 

Thanks,
Song